The present invention relates generally to computer systems and software, and specifically to tools and methods for programming the reaction of a computer system to specified events and conditions.
Reactive systems is a term that is used generally to refer to computer applications that detect, evaluate and respond to events. Such events may include substantially any occurrence of interest that is detected by the computer, such as a change in the price of a stock, the beginning of a banking transaction, change of an entry in a database or a suspected fault in a computer or communication system. The timing, sequence and content of these events are generally not known in advance.
Various tools have been developed in order to allow events and their attendant reactions to be specified in a general, flexible way. Many of these tools are based on Event-Condition-Action (ECA) rules and provide a language of operators for specifying these rules. Some of these languages enable complex events to be defined as the composition of multiple simple events, for example, successive withdrawals from one or more bank accounts. Some languages also allow a complex event to be composed of a number of subsidiary complex events. In addition, a particular order or other timing constraints on the component events may be specified.
Once the complex event has been detected, there may be one or more conditions that qualify the event, for example, that the amounts of the withdrawals be greater than a specified threshold. If the conditions are satisfied, then an action is triggered, such as alerting the bank""s security manager of a possible fraud. In the context of the present patent application, a specified composition of events together with the conditions attached to these events is referred to as a situation. Tools for specification of ECA rules generally make a clear separation between the event and condition portions of the rule. Thus when a computer evaluates a given situation on the basis of such tools, it first determines that an instance of the event has occurred, i.e., that all of the component events have occurred in the proper order, and only then evaluates the conditions associated with the event.
Gehani et al., in an article entitled xe2x80x9cCOMPOSE: A System for Composite Event Specification and Detection,xe2x80x9d in Lecture Notes in Computer Science 759 (Springer-Verlag, 1993), pp. 3-15, which is incorporated herein by reference, describe a reactive system in which primitive events can have attributes. The attributes may be associated with the event itself, such as a transaction ID, or they may be determined by some external condition at the time the event occurs. In specifying a rule based on such an event, a predicate (or condition) can be defined on these attributes such that, when the predicate is false, the occurrence of the event is xe2x80x9cmaskedxe2x80x9d and does not trigger an action specified by the rule.
Processing of the events when they occur is performed using a finite state machine, wherein evaluation of the conditions is done in a separate phase, after event processing has been completed.
ECA rules have received substantial research attention in the field of active database management systems. In these systems, ECA rules are attached to a database in order to monitor situations of interest that may occur in the database (or beyond the database, as appropriate), and trigger timely responses when the situations occur, even without an explicit request from a user or application. A technical report by Zimmer et al., entitled xe2x80x9cA General Model for Specification of the Semantics of Complex Events in Active Database Management Systems,xe2x80x9d C-LAB Report March 1997 (Cooperative Computing and Communication Laboratory, Paderborn, Germany), which is incorporated herein by reference, provides a survey and critique of work in this field, including various languages that have been developed for the specification of events and ECA rules.
One such language is xe2x80x9cSnoop,xe2x80x9d which is described by Chakravarthy et al., in a report entitled xe2x80x9cSnoop: An Expressive Event Specification Language for Active Databasesxe2x80x9d (Tech. Report UF-CIS-TR-93-007, Department of Computer and Information Sciences, University of Florida, Gainesville, March, 1993), which is incorporated herein by reference. Snoop, like other event specification languages, defines certain event operators used for constructing complex events. The operators provided by Snoop include conjunction, disjunction and sequence, as well as xe2x80x9caperiodicxe2x80x9d and xe2x80x9cperiodicxe2x80x9d event operators. Aperiodic operators are used to express the occurrence of a particular event within an interval bounded by two or more other events. Periodic operators express the occurrence of a particular event within a specified time interval of the occurrence of a preceding event. In either case, an action may be triggered on every occurrence of the particular event, or only on the first occurrence.
It is an object of some aspects of the present invention to provide improved tools and systems for situation management.
It is a further object of some aspects of the present invention to provide tools and methods for classifying and responding to temporal relationships among events.
It is still a further object of some aspects of the present invention to provide efficient methods for processing events and conditions that occur.
In preferred embodiments of the present invention, a situation management system provides tools for defining intervals during which a given situation is meaningful and for detecting and reacting to the occurrence of the situation during such intervals. In the context of the present patent application and in the claims, an interval of this sort is referred to as a xe2x80x9clifespan.xe2x80x9d A lifespan begins with an initiating event, or initiator, and ends with a terminating event, or terminator. The situation management system enables manipulation of the initiator and terminator, such as by attachment of conditions to the initiating and terminating events. It also allows multiple, interrelated lifespans to run concurrently, with predefined relations between the lifespans. Thus, the situation management system enables temporal relations among events to be defined and detected simply and flexibly.
In some preferred embodiments of the present invention, composition filtering and content filtering are jointly applied to detected situations. Composition filtering refers to detection of complex events, as described hereinabove, while content filtering refers to evaluation of the conditions applied to detected events. The situation management system allows a timing relationship to be defined between composition and content filtering, unlike systems known in the art, in which event detection and condition evaluation are distinct and independent processing stages. Thus, in the present system, composition and content filtering may be performed concurrently or, alternatively, content filtering may deferred and applied to events only at the end of a lifespan in which they occur. Concurrent composition and content filtering enables the system to discard immediately events that do not meet the specified conditions, thereby reducing the computation and storage burden on the system relative to systems known in the art.
In further preferred embodiments of the present invention, quantifiers are provided so as to define how the situation management system is to respond to repeated occurrences of a given event. Preferably, the quantifiers indicate to the system whether it is to react to the first or last instance of the event in a given lifespan, or to each instance in the lifespan. The quantifiers may be applied to substantially any type of event or situation detected by the system, including both simple and complex events, as well as events that serve as lifespan initiators and terminators.
There is therefore provided, in accordance with a preferred embodiment of the present invention, a method for situation management, including:
specifying a composite event as a combination of two or more predefined component events;
defining a rule, which causes a reaction to be invoked upon an occurrence of the composite event subject to a given condition;
receiving at least first and second instances of the component events before invoking the reaction;
evaluating the first instance subject to the condition, so as to determine whether the first instance can satisfy the rule, before evaluating the second instance; and
responsive to evaluating the first instance subject to the condition, determining that the composite event has occurred and invoking the reaction.
Preferably, receiving the first and second instances includes receiving instances of first and second component events of the composite event, wherein determining that the composite event has occurred includes composing the composite event using the first and second instances, subject to the given condition.
Alternatively, receiving the first and second instances includes receiving two instances of the same component event, wherein determining that the composite event has occurred includes, when the first instance does not satisfy the rule, evaluating the second instance subject to the condition and determining that the composite event has occurred responsive to evaluating the second instance.
There is also provided, in accordance with a preferred embodiment of the present invention, a method for situation management, including:
specifying a lifespan, having an initiation associated with an occurrence of an initiator event and a termination associated with an occurrence of a terminator event;
attaching a condition to at least one of the initiator and terminator events, such that at least one of the initiation and the termination of the lifespan takes place subject to the condition;
defining a rule, which causes a reaction to be invoked upon an occurrence of an invoking event during the lifespan;
receiving event instances, including at least one instance of each of the initiator event, invoking event and terminator event;
evaluating the instances of the events subject to the condition so as to determine that the invoking event has occurred during the lifespan; and
responsive to evaluating the instances, invoking the reaction.
In a preferred embodiment, at least one of the initiator and terminator events is a complex event, composed of a plurality of component events.
Preferably, evaluating the instances of the events subject to the condition includes evaluating the at least one instance of the initiator event subject to the condition, so as to determine whether to begin the lifespan, before receiving the instance of the invoking event.
In a preferred embodiment, defining the rule includes specifying whether to evaluate one or more instances of the invoking event that occur during the lifespan immediately, or to evaluate the one or more instances only upon receiving the terminator event, and wherein evaluating the instances of the events subject to the condition includes deciding, responsive to the rule, when to evaluate the one or more instances of the invoking event subject to the condition. Preferably, evaluating the instances of the events subject to the condition includes, responsive to deciding to evaluate the one or more instances of the invoking event immediately, evaluating a first one of the instances of the invoking event subject to the condition before evaluating any subsequent one of the event instances.
In another preferred embodiment, receiving the instances includes receiving a plurality of instances of the initiator event, and evaluating the instances includes associating two or more respective lifespans with two or more of the plurality of initiator events, and evaluating the at least one instance of the invoking event with respect to each of the two or more lifespans.
Preferably, defining the rule includes specifying, for a case in which multiple instances of the invoking event occur during the lifespan, which of the multiple instances to evaluate. Most preferably, specifying which of the multiple instances to evaluate includes specifying that a first or last instance in the lifespan is to be evaluated or, alternatively or additionally, specifying that each of the instances is to be evaluated.
There is further provided, in accordance with a preferred embodiment of the present invention, a method for situation management, including:
specifying a lifespan, defined by an initiator event and a terminator event;
defining a rule, which causes a reaction to be invoked upon the occurrence of an interim event during the lifespan;
receiving multiple instances of the initiator event before the terminator event has occurred;
opening multiple instances of the lifespan, responsive to the multiple instances of the initiator event;
receiving an instance of the interim event;
evaluating the instance of the interim event with respect to at least two of the multiple instances of the lifespan, so as to determine that the invoking event has occurred during at least one of the instances of the lifespan; and
responsive to evaluating the instance of the interim event, invoking the reaction.
Preferably, opening the multiple instances of the lifespan includes opening at least two instances of the lifespan such that the at least two instances of the lifespan are open concurrently. Further preferably, the method includes receiving an instance of the terminator event, wherein evaluating the instance of the interim event includes determining that the at least two of the instances of the lifespan are terminated by the same instance of the terminator event. Alternatively, evaluating the instance of the interim event includes determining that the at least two of the instances of the lifespan are terminated by different, respective ones of the instances of the terminator event.
In a preferred embodiment, receiving the multiple instances of the initiator event includes receiving first and second instances of the initiator event, and opening the multiple instances of the lifespan includes opening a first instance of the lifespan opened responsive to the first instance of the initiator event, and the method includes closing the first instance of the lifespan responsive to the second instance of the initiator event.
There is additionally provided, in accordance with a preferred embodiment of the present invention, situation management apparatus, including:
a memory, which stores a specification of a composite event as a combination of two or more predefined component events, and which stores a definition of a rule, which causes a reaction to be invoked upon an occurrence of the composite event subject to a given condition; and
a processor, which is coupled to read the specification and the rule from the memory, and which is configured to receive at least first and second instances of the component events and, when the at least first and second instances of the component events are received before invoking the reaction, to evaluate the first instance subject to the condition, so as to determine whether the first instance can satisfy the rule, before evaluating the second condition, thus to determine that the composite event has occurred and invoke the reaction responsive thereto.
In a preferred embodiment, the memory further stores a database, and wherein at least one of the component events includes a change in a record in the database. In another preferred embodiment, the processor is configured to receive at least one of the component events via a network.
There is furthermore provided, in accordance with a preferred embodiment of the present invention, situation management apparatus, including:
a memory, which stores a specification of a lifespan, having an initiation associated with an occurrence of an initiator event and a termination associated with an occurrence of a terminator event, together with a condition attached to at least one of the initiator and terminator events, such that at least one of the initiation and the termination of the lifespan takes place subject to the condition, and which stores a definition of a rule, which causes a reaction to be invoked upon an occurrence of an invoking event during the lifespan; and
a processor, which is coupled to read the specification, condition and rule from the memory, and which is configured to receive event instances, including at least one instance of each of the initiator event, the invoking event and the terminator event, and to evaluate the instances of the events subject to the condition so as to determine that the invoking event has occurred during the lifespan and invoke the reaction response thereto.
There is moreover provided, in accordance with a preferred embodiment of the present invention, situation management apparatus, including:
a memory, which stores a specification of a lifespan, defined by an initiator event and a terminator event, and which stores a definition of a rule, which causes a reaction to be invoked upon the occurrence of an interim event during the lifespan; and
is a processor, which is coupled to read the specification and the definition from the memory, and which is configured to receive multiple instances of the initiator event before the terminator event has occurred and to open multiple instances of the lifespan, responsive to the multiple instances of the initiator event, and further to receive an instance of the interim event and to evaluate the instance of the interim event with respect to at least two of the multiple instances of the lifespan, so as to determine that the invoking event has occurred during at least one of the instances of the lifespan and invoke the reaction responsive thereto.
There is also provided, in accordance with a preferred embodiment of the present invention, a computer software product, including program instructions stored in a computer-readable medium, which instructions, when read by a computer, cause the computer to read a specification of a composite event as a combination of two or more predefined component events and to read a definition of a rule, which indicates a reaction to be invoked upon an occurrence of the composite event subject to a given condition, and which instructions further cause the computer, when it receives at least first and second instances of the component events before invoking the reaction, to evaluate the first instance subject to the condition, so as to determine whether the first instance can satisfy the rule, before evaluating the second condition, and responsive to evaluating the first instance subject to the condition, to determine that the composite event has occurred and to invoke the reaction responsive thereto.
Preferably, the product is adapted for use in active database management.
There is further provided, in accordance with a preferred embodiment of the present invention, a computer software product, including program instructions stored in a computer-readable medium, which instructions, when read by a computer, cause the computer to read a specification of a lifespan, having an initiation associated with an occurrence of an initiator event and a termination associated with an occurrence of a terminator event, and further to read a condition attached to at least one of the initiator and terminator events, such that at least one of the initiation and the termination of the lifespan is to take place subject to the condition, and also to read a definition of a rule, which indicates a reaction to be invoked upon an occurrence of an invoking event during the lifespan, and which instructions further cause the computer, when it receives event instances including at least one instance of each of the initiator event, invoking event and terminator event, to evaluate the instances of the events subject to the condition so as to determine that the invoking event has occurred during the lifespan and to invoke the reaction responsive thereto.
There is additionally provided, in accordance with a preferred embodiment of the present invention, a computer software product, including program instructions stored in a computer-readable medium, which instructions, when read by a computer, cause the computer to read a specification of a lifespan, defined by an initiator event and a terminator event, and to read a definition of a rule, which causes a reaction to be invoked upon the occurrence of an interim event during the lifespan, and which instructions further cause the computer, when it receives multiple instances of the initiator event before the terminator event has occurred, and further receives an instance of the interim event, to open multiple instances of the lifespan, responsive to the multiple instances of the initiator event, and to evaluate the instance of the interim event with respect to at least two of the multiple instances of the lifespan, so as to determine that the invoking event has occurred during at least one of the instances of the lifespan and to invoke the reaction responsive thereto.
The present invention will be more fully understood from the following detailed description of the preferred embodiments thereof, taken together with the drawings in which: